Navaro Logo
Home Features Integrations About Us Pricing
Sign In Start Free Trial

Last updated: 13th October 2026

Privacy Policy

Navaro (“we”, “our”, or “us”) is a product of D&M Nexus Inc. Ltd, a UK-registered company (Company No. 16485461). You can view our registered office details on Companies House. This Privacy Policy explains how we collect, use, disclose, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR).

Quick Summary

  • We collect data about your organisation, users, clients, and system usage to provide and improve our services.
  • Your primary data is stored and processed securely within United Kingdom data centers.
  • Your data is protected with strong security measures including encryption both in transit and at rest.
  • We share data only with trusted third parties under strict contractual obligations and never sell your data.
  • You have rights under UK GDPR including access, correction, deletion, and marketing opt-out.
  • We comply with international data transfer safeguards for any third-party services.
  • Contact us anytime for privacy concerns or to exercise your rights.

1. Data We Collect

a. Organisation & User Data

  • Organisation name, contact details, and address
  • Staff member names and email addresses
  • User roles and access levels
  • Platform preferences and configuration

b. Client Data

  • Client names and contact information
  • Booking details (e.g., date, time, location, purpose)
  • Notes and additional metadata (e.g., access needs, invoicing history)

c. System & Usage Data

  • IP address, browser/device type
  • Date/time of activity and visited pages
  • Error logs and diagnostic information

1A. Our Role

D&M Nexus Inc. Ltd acts as the data controller for the personal data collected via the Navaro platform. In some cases, client organisations using Navaro may also be considered data controllers for personal data they input or manage. This means we and/or client organisations determine the purposes and means of processing your personal data.

2. How We Use Your Data

We use your personal data to:

  • Provide, operate, and maintain the Navaro platform
  • Manage bookings, schedules, and client communications
  • Authenticate users and manage access rights
  • Communicate important updates, including security alerts and support messages
  • Comply with legal and regulatory obligations
  • Improve platform functionality, security, and user experience through analytics and feedback
  • Prevent, detect, and respond to fraud, abuse, or security incidents

3. Legal Basis for Processing

We process your personal data based on one or more of the following legal grounds:

  • Performance of a contract with you or your organisation
  • Compliance with a legal obligation
  • Your consent, where applicable
  • Our legitimate interests, such as improving platform security and services

4. Data Security & Server Location

We store and process your primary personal data within secure data centers located in the United Kingdom. We implement appropriate technical and organisational measures to protect your personal data against unauthorized access, loss, misuse, or alteration. These measures include encryption of data both in transit (TLS 1.3/HTTPS) and at rest (AES-256). Access to your data is restricted to authorised personnel only. In the unlikely event of a data breach, we have procedures in place to notify affected individuals and relevant authorities promptly as required by law.

5. When We Share Your Data

We may share your personal data with:

  • Trusted service providers who perform services on our behalf, such as payment processors, hosting providers, CRM, and analytics services, all bound by strict contractual obligations to protect your data
  • Legal authorities or regulators when required by law or to protect rights and safety
  • Other users of the platform, only to the extent necessary for user-to-user communications

We do not sell your personal data to third parties.

6. Payment Processing

Payments are processed securely through Stripe. We do not store your payment card details; Stripe handles all payment information in compliance with PCI DSS standards.

6A. Accounting & Financial Integrations (QuickBooks Online & Xero)

If your organisation chooses to connect Navaro with an accounting platform, such as QuickBooks Online (provided by Intuit Inc.) or Xero (provided by Xero Limited), we facilitate a secure 2-way synchronization between Navaro and your accounting ledger:

  • Data Shared with Accounting Providers: When an invoice or client is created or updated in Navaro, we transmit necessary billing data to your connected accounting provider, including customer contact details (name, email address, phone number, billing address), invoice numbers, issue dates, due dates, line item descriptions, tax rates, and transaction totals.
  • Data Received from Accounting Providers: When an invoice is settled or updated in your accounting software, we receive payment confirmations, payment timestamps, and balance updates via webhooks and secure API endpoints to automatically update corresponding records in Navaro.
  • Security & Token Encryption: OAuth 2.0 access and refresh tokens used to authenticate with QuickBooks Online and Xero are stored securely using industry-standard AES-256 encryption at rest.
  • Revocation & Disconnection: You can disconnect your accounting integration at any time via Settings > Integrations in the Navaro dashboard or by revoking access directly in your Intuit or Xero portal. Disconnecting stops any future synchronization immediately.
  • No Sale of Data: We never sell, lease, or monetize your accounting or customer data. Intuit processes data under their Global Privacy Statement, and Xero processes data under their Xero Privacy Notice.

6B. CRM & Email Marketing Integrations (HubSpot & Mailchimp)

If your organisation chooses to connect Navaro with customer relationship management or marketing platforms, we facilitate secure data synchronization:

  • HubSpot: When connected, client contact details and booking enquiries (enquiry name, email, dates, status, and enquiry value) may be synchronized to your HubSpot account as Contacts and Deals to assist with client relationship management. HubSpot processes data in accordance with the HubSpot Privacy Policy.
  • Mailchimp: When connected, client contact information may be synchronized to your specified Mailchimp audiences. Sync is strictly restricted to clients who have explicitly opted in to receive marketing communications. Mailchimp processes data in accordance with the Intuit Mailchimp Privacy Statement.
  • Security & Revocation: Authentication tokens are encrypted at rest with AES-256, and integrations can be disconnected immediately at any time via Settings > Integrations.

7. Social Logins

If you choose to log in using social accounts such as Google or Facebook, we receive basic profile information from these providers to facilitate authentication. We do not store your social login credentials.

8. Analytics, Diagnostic & Security Services

To monitor platform health, prevent abuse, and evaluate user experience, we use the following third-party services:

  • Google Analytics & Google Tag Manager: Website traffic analysis (operated strictly under explicit cookie consent). You can opt out via our cookie preference centre or by using the Google Analytics Opt-out Browser Add-on.
  • Contentsquare: Digital experience and user journey analytics, helping us understand how visitors interact with the site to resolve user difficulties (loaded strictly after explicit cookie consent).
  • Intuer RUM: Real-user performance monitoring and error telemetry to ensure rapid resolution of application bugs (loaded strictly after explicit cookie consent).
  • Google reCAPTCHA: Bot prevention and security verification on authentication and enquiry forms to prevent fraud and spam (loaded on demand for legitimate security interests).

9. Cookies and Tracking

Our website uses cookies and similar technologies in compliance with UK PECR and UK GDPR. Non-essential analytics and tracking technologies are only activated after you grant explicit consent via our cookie banner. For full details on cookie categories, purposes, and retention, please review our Cookie Policy.

10. International Data Transfers

Primary platform data and databases are hosted within data centers located in the United Kingdom. Where third-party service providers (such as Stripe, Intuit Inc., Xero Limited, HubSpot Inc., Mailchimp, or Google) process data outside the UK, we ensure that appropriate safeguards, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO) or International Data Transfer Agreements (IDTA), are in place in accordance with UK GDPR requirements.

11. Data Retention

We retain your personal data only as long as necessary to fulfil the purposes outlined in this policy or as required by law:

  • Account and billing data: 6 years after contract end (legal obligations)
  • User activity logs: 12 months
  • Account and all associated data (including bookings and client records): Deleted 90 days after account becomes inactive following cancellation, unless the subscription is renewed.

Data is securely deleted or anonymized when no longer required.

12. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Access: Request a copy of your personal data.
  • Correction: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your data where applicable.
  • Restriction: Request limitation of processing in certain circumstances.
  • Data Portability: Receive your data in a structured, commonly used format.
  • Withdraw Consent: Withdraw consent at any time where processing is based on consent.
  • Object: Object to processing based on legitimate interests or direct marketing.
  • Marketing Opt-Out: You can opt out of receiving marketing communications by following the unsubscribe instructions in those communications or by contacting us directly.
  • Complain: Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your rights have been violated.

To exercise your rights, please contact us at [email protected]. We may require identity verification to process your request. We aim to respond within one month.

13. Children's Data

Navaro is not intended for children under 13 years of age. We do not knowingly collect personal data from children without parental consent. If we become aware that we have collected such data, we will delete it promptly.

14. User-to-User Communications

Our platform may enable communication between users. We do not monitor these messages but reserve the right to intervene if misuse is reported or detected.

15. Automated Decision Making

We do not use automated decision-making processes that have a legal or similarly significant effect on you.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on our website and updating the “Last updated” date. We encourage you to review this policy periodically.

17. Contact Us

D&M Nexus Inc. Ltd (Navaro Team)

Registered Office: 62 The Cornfields, Basingstoke, RG22 4QD, United Kingdom

Company Number: 16485461

Website: https://navaro.uk

Email: [email protected]